Skip to main content

2 posts tagged with "provisioning"

View All Tags

SCIM Explained: What It Is, When You Need It, and How Keycloak Does It

· 7 min read
GR Patil
GR Patil
Phase Two

SCIM — System for Cross-domain Identity Management — is a standard REST API for creating, updating, and deactivating user accounts across systems. SSO answers "can this person log in?" SCIM answers "does this person have an account at all, and should they still?"

If you sell to enterprises, you will be asked for it. This post covers what it is, when you actually need it, and a working walkthrough of Keycloak's native SCIM API — which arrived as a preview feature and is not enabled by default.

Everything here was run against Keycloak 26.7.3.

Experimental SCIM 2.0 provisioning for Organizations

· 5 min read
GR Patil
GR Patil
Phase Two

We're shipping experimental SCIM 2.0 provisioning for the Phase Two Organizations extension. Each organization in a realm can now act as its own SCIM 2.0 service provider, so an upstream IdP like Okta or Entra ID can push users into a specific tenant rather than into the realm as a whole.

This is the piece of the multi-tenant story that Keycloak's stock SCIM support doesn't address today, and it's been a heavily requested item from customers running Organizations in production.